Kyber1024

ransomware 2026-04-23
Kyber Ransomware: First Production PQC Deployment — Rust Windows Variant, ESXi Variant, Same Affiliate
Rapid7 recovered two Kyber variants from a single incident: a Rust-based Windows encryptor that actually implements Kyber1024 + X25519 + AES-CTR, and an ESXi encryptor whose 'post-quantum' claim is just ChaCha8 under RSA-4096. Same campaign ID, same Tor infrastructure, same affiliate.
ransomware kyber post-quantum esxi hyper-v rust-malware chacha8 kyber1024 x25519 rapid7

Kyber Ransomware: First Production PQC Deployment — Rust Windows Variant, ESXi Variant, Same Affiliate